CVE-2026-101547
MediumCVSS 6.1Summary
Vulnerability in Oracle Demand Planning (Internal Operations component) affecting versions 12.1 and 12.2. An unauthenticated attacker with network access via HTTP can exploit it, but human interaction is required; attacks may significantly impact additional products (scope change). Successful attacks can result in unauthorized update, insert or delete access to some data and unauthorized read access to a subset of data.
Risk Assessment
Organizations using Oracle Demand Planning may face unauthorized modification or read access to data, and due to scope change the attack may also impact other systems.
Recommendation
Apply the available Oracle security updates for versions 12.1 and 12.2, restrict network access to the application, and enforce least privilege.
Other vulnerabilities in Oracle Demand Planning
See all- CVE-2026-70846Critical
Vulnerability in Oracle Demand Planning (Oracle Supply Chain), component Internal Operations. Affected versions are 12.1 and 12.2. A low privileged attacker can remotely access and modify data via HTTP, with impact on other products.
- CVE-2016-3527Critical
Unspecified vulnerability in the Oracle Demand Planning component in Oracle Supply Chain Products Suite 12.1 and 12.2 allows remote attackers to affect confidentiality and integrity via vectors related to ODPDA Servlet.
- CVE-2026-83394Medium
Vulnerability in the Internal Operations component of Oracle Demand Planning (Oracle Supply Chain) in versions 12.1 and 12.2. A low-privileged attacker with HTTP network access can gain unauthorized access to critical data, requiring user interaction and potentially impacting additional products.
- CVE-2026-70852High
Vulnerability in Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Affects versions 12.1 and 12.2. An unauthenticated attacker with network access via HTTP can easily compromise the system. Successful attacks may result in unauthorized access to critical data or complete access to all Oracle Demand Planning data, as well as unauthorized update, insert, or delete access to some data.
Original NVD description (English source)
Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demand Planning. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Demand Planning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Demand Planning accessible data as well as unauthorized read access to a subset of Oracle Demand Planning accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS